Insecure Read-Permission Handling in Secure Custom Fields by WordPress
CVE-2026-97194
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 8 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-97194?
The Secure Custom Fields plugin for WordPress lacks proper read-permission checks when displaying relational field values. This vulnerability allows users with post-editing capabilities, such as Contributors and above, to gain access to unpublished posts' titles and non-public statuses created by other users. This poses a significant risk to user privacy, as it enables unauthorized disclosure of sensitive information that should remain confidential.
Affected Version(s)
Secure Custom Fields 0 < 6.9.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.